How to Review a Client's Spend Controls Before the Auditor Starts Asking Questions

Almost every CA has had a client swear their spend process is under control. We all know how often that turns out to be only half true. Real-time visibility into spend, believe it or not, is still uncommon in smaller and mid-sized organisations.

A client can have a perfectly sensible approval policy on paper and still have very little control over how money is actually spent. Lack of consistent oversight does not stay invisible for long. Eventually, it shapes up to be an audit risk the moment anyone looks closely. This article sets out what to review first, and how to open that conversation with a promoter constructively.

The sections ahead cover approval structures, documentation, reimbursements, control overrides, and ways to strengthen weak processes before they draw audit attention.

Step 1: Map the Approval Chain

Naturally, most approval chains were designed once, at a point when the company was a different size, and never touched again. Over the years, authority can change informally while the matrix remains formally intact.

This is why asking to see the policy document tells you almost nothing. Ask instead who approved the last twenty payments over a certain size, and whether that list matches the org chart as it stands now, not as it stood when the policy was written. The gap between those two lists is where the real risk sits.

A Rs 5 lakh approval ceiling means less when the same person controls several earlier stages.

Review how those permissions developed over time. Promotions, temporary cover arrangements, resignations, restructurings, and system migrations can leave access rights that no longer fit current responsibilities.

Promoter-led businesses introduce another layer of complexity. The promoter may formally approve most expenditure, while teams make commitments beforehand because waiting would interrupt operations. In that situation, the recorded approval can become confirmation of a decision already made.

Tammy Thomas described the underlying control principle during a 2026 Journal of Accountancy podcast. Discussing authority over funds, she said: “There really does need to be a separation.”

Also establish when finance first sees the commitment. Visibility only after an invoice, reimbursement, or card charge appears leaves little room for preventive review.

Then test several recent transactions against the mapped chain. This comparison usually reveals where formal authority and operational authority have separated. Once you have that map, the next step is comparing it against what recent transactions are showing.

Step 2: Test the Control in Practice

A mapped approval chain is just a theory until you check it against real payments. Pick a handful of small but deliberate samples across routine payments, larger purchases, reimbursements, subscriptions, urgent spend, and senior management transactions.

You are looking for the chronology behind each payment, especially the point at which approval entered the process.

For each transaction, trace:

• when the commitment was made;
• when approval was requested and recorded;
• when the invoice or claim reached finance;
• when payment was released; and
• where any exception entered the process.

The chronology is important because an approval can exist without providing much control. If approval arrives after a vendor commitment, finance may have little room left to challenge the expenditure.

Next, look across the sample rather than reviewing every exception in isolation. One emergency payment can be reasonable. Repeated emergency payments through the same person, vendor, or department tell you something more useful.

Also watch for amounts changed after approval, purchases split below thresholds, and recurring subscriptions continuing without fresh review. Patterns like these show where exceptions have started functioning as an unofficial route around the formal process.

By now, you should know where the control works consistently and where business practice has moved ahead of it.

Step 3: Follow the Audit Trail

Once transaction testing begins, treat the documentation as a timeline and not a checklist of available files. Follow each transaction through request, approval, invoice, payment, and ledger posting, then check when each piece of evidence appeared.

Common gaps to check for:

• Approvals that exist only in email or WhatsApp, never recorded in the system
• Invoices or receipts missing altogether
• Purchase amounts that changed after approval was given
• Supporting documents uploaded weeks or months after the transaction
• Vendor bank details changed without any review on record
• Expense descriptions too vague to tell you what the money actually paid for

One missing invoice can be a clerical slip. The same gap repeating across a category, month after month, is a different problem entirely. Documentary evidence also deserves scrutiny beyond simple availability.

The ACFE's 2024 Report to the Nations found 89% of occupational fraud cases involved proactive concealment. Fraudulent physical documents appeared in 41% of cases, while altered physical documents appeared in 37%.

For review, this makes provenance and timing worth checking alongside completeness. An invoice sitting in the file tells you less if nobody can establish when it arrived, who reviewed it, or if its contents changed later.

Step 4: Examine Reimbursements and Bypassed Spend

Reimbursements sit in a different category from every other control you have tested so far, because the money moves before finance ever sees the transaction. In practice, approval, if it happens at all, becomes a review of a decision already made rather than a check on one about to happen.

Start by looking for concentration and repetition across claimants, departments, categories, and approvers. A high reimbursement volume from one team may point to a purchasing process people find too slow or impractical.

Also review the timing and structure of claims:

• long gaps between the expense date and submission;
• approvals recorded only after reimbursement;
• repeated missing receipts or vague business descriptions;
• several claims sitting just below approval thresholds; and
• recurring purchases processed personally instead of through procurement.

Then widen the review beyond reimbursements. Corporate cards, petty cash, subscriptions, emergency purchases, and direct vendor payments can become parallel spending routes when they sit outside established procurement controls. Procurement teams refer to this as maverick buying, meaning purchases made outside organisational procurement standards.

The common issue is visibility before commitment. If finance sees spend only after payment, the control has already lost much of its preventive value.

A heavy reimbursement pattern can therefore tell you something useful about the wider process. Employees may be working around procurement because the approved route no longer fits daily operations.

Step 5: Review Overrides and Promoter Dependence

Not every override is a red flag. A genuine commercial reason will always exist in a healthy business. What you are checking isn't whether overrides happen, but how they happen and how often the same desk reaches for one.

Pull a list of every override for the past year and who authorised each. A handful tied to specific, explainable events is normal. The same name showing up repeatedly, across unrelated categories, tells you the approval limit has stopped functioning as a limit.

Promoter dependence is a related but separate issue. In many growing businesses, one person still signs off on routine spend because that setup worked fine when the company was smaller. Nobody bothers to revisit it once the business outgrows it.

One way to raise this with a promoter is to frame it as strengthening the control, not removing his say over it. They can keep full visibility while routine decisions move to defined limits below him.

Practical changes may include:

• Tiered approval thresholds;
• Category-based authority;
• Backup approvers for absences;
• Documented exception routes;
• Periodic reviews of delegated limits; and
• Separate reporting for unusual or high-value spend.

Done well, delegation removes unnecessary bottlenecks without weakening the promoter's control over significant spending.

In Closing, I'd Suggest You Leave Less to Memory

The strongest spend processes do not depend on someone remembering how an approval happened six months ago. They leave a clear enough trail for another person to follow without filling gaps through assumption.

Helping clients reach this point can save considerable time later, especially during audits, funding discussions, or lender reviews. You do not need to redesign every control at once.

Start with recurring weaknesses and areas where responsibility has become blurred through growth. Improvements made there can gradually strengthen the wider process. By the next review, fewer transactions should need explanation, and management should have a much clearer view of where company money is going.

Authored by Rajith Shaji (Co-founder and CEO of Volopay)